#!/bin/bash

# ----------------------------------------------------------------------
# Filename:   port.sh
# Version:    1.0
# Date:       2013/12/16
# Author:     huijing.hei
# Email:      huijing.hei@cs2c.com.cn
# Summary:    03系统安全功能-01SELinux-03SELinux重要命令-04SELinux策略维护工具semanage-02端口管理
# Notes:       ***
# Copyright:    China Standard Software Co., Ltd.
# History：     
#             Version 1.0, 2013/12/16
#             - port management.
# ----------------------------------------------------------------------

##! @TODO: enforcing
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function DoSetup()
{
    trap DoCleanup EXIT INT 

    IsRoot
    EchoResult "root"

    CmdCheck getenforce semanage

    # check selinux status is enforcing or permissive
    CheckSElinuxStatus
    EchoResult "check selinux status is enforcing or permissive"

    # set selinux enforcing
    SELINUX_STATUS=`getenforce | tr A-Z a-z`
    SetSElinux enforcing
    EchoResult "set selinux enforcing"

    # start httpd
    SERV=httpd
    StatusDaemon ${SERV}
    SERVICE_STATUS=$?
    SetService ${SERV} start
    EchoResult "set  ${SERV} start"

    netstat -ntlp | grep ${SERV}
    EchoResult "start ${SERV}"

    PORT=91

    # check http_port_t
    HTTP_PORT_T=`semanage port -l | grep http_port_t | grep ${PORT}`
    if [ -z ${HTTP_PORT_T} ];then
        echo "PASS: http_port_t is not listened ${PORT}"
    else
        echo "FAIL: http_port_t is listened ${PORT},pls check"
        exit 1
    fi

    # backup httpd.conf
    HTTP_CONF=/etc/httpd/conf/httpd.conf
    HTTP_CONF_BAK=${HTTP_CONF}.$$
    [ -f ${HTTP_CONF} ] && cp ${HTTP_CONF} ${HTTP_CONF_BAK}

    # change default port 80
    sed -i "s/^Listen 80$/Listen ${PORT}/g" ${HTTP_CONF}
    EchoResult "change httpd default port to ${PORT}"
    

}

##! @TODO: 
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure
function DoTest()
{

    ! RestartDaemon ${SERV}
    EchoResult "restart ${SERV} should failed" 

    # add tcp 81
    cmd="semanage port -a -t http_port_t -p tcp ${PORT}"
    $cmd
    EchoResult "$cmd"

    # restart httpd
    RestartDaemon  ${SERV}
    EchoResult "restart ${SERV} should succeed" 

    # check http_port_t
    HTTP_PORT_T=`semanage port -l | grep http_port_t | grep ${PORT}`
    if [ -n "${HTTP_PORT_T}" ];then
        echo "PASS: http_port_t is listened ${PORT}"
    else
        echo "FAIL: http_port_t is not listened ${PORT},pls check"
        exit 1
    fi

}
##! @TODO: cleanup
##! @AUTHOR: huijing.hei
##! @VERSION: 1.0 
##! @OUT: 0 => success; 1 => failure

function DoCleanup()
{
    # delete port
    semanage port -d -t http_port_t -p tcp ${PORT}
    
    # restore httpd.conf
    [ -f ${HTTP_CONF_BAK} ] && mv -f ${HTTP_CONF_BAK} ${HTTP_CONF}

    # restore httpd
    SetService ${SERV} ${SERVICE_STATUS}

    # restore selinux
    SetSElinux ${SELINUX_STATUS}
    EchoResult "restore selinux to ${SELINUX_STATUS}"
}

# include lib files

if [ -z "$SFROOT" ]
then
    echo "SFROOT is null, pls check"
    exit 1
fi

. ${SFROOT}/lib/Echo.sh
. ${SFROOT}/lib/Check.sh
. ${SFROOT}/lib/NetOps.sh
. ${SFROOT}/testcases/SELinux/lib/UserOps.sh
. ${SFROOT}/testcases/SELinux/lib/Selib.sh

export LANG=C

DoSetup
DoTest
EchoResult "testcase: selinux port management"
echo ""
